On Tue, Nov 18, 2025 at 01:08:39PM +0100, Peter Marko wrote: > From: Peter Marko <[email protected]> > > This commit fixes commit 08595b39b46ef2bf3a928d4528292ee31a990c98 > which adapts vex creation between function create_spdx where all changes > were backported and funtion get_patched_cves where changes were not > backported. > > CVE patches were previously ignored as they cannot be decoded from > CVE_STATUS variables and each caused a warning like: > WARNING: ncurses-native-6.4-r0 do_create_spdx: Skipping CVE-2023-50495 — > missing or unknown CVE status > > Master branch uses fix-file-included for CVE patches however since > cve-check-map.conf was not part of spdx-3.0 backport, closest one > available (backported-patch) was implemented. >
Hi Peter, I tested it and this looks good to me, it fixes the missing/unknown CVE status warnings. Thanks for preparing the patch. Greetings, Kamel > Signed-off-by: Peter Marko <[email protected]> > --- > meta/lib/oe/spdx30_tasks.py | 8 +++++++- > 1 file changed, 7 insertions(+), 1 deletion(-) > > diff --git a/meta/lib/oe/spdx30_tasks.py b/meta/lib/oe/spdx30_tasks.py > index 6b0aa137c4..8115088ab8 100644 > --- a/meta/lib/oe/spdx30_tasks.py > +++ b/meta/lib/oe/spdx30_tasks.py > @@ -503,7 +503,13 @@ def create_spdx(d): > if include_vex != "none": > patched_cves = oe.cve_check.get_patched_cves(d) > for cve_id in patched_cves: > - mapping, detail, description = oe.cve_check.decode_cve_status(d, > cve_id) > + # decode_cve_status is decoding CVE_STATUS, so patch files need > to be hardcoded > + if cve_id in (d.getVarFlags("CVE_STATUS") or {}): > + mapping, detail, description = > oe.cve_check.decode_cve_status(d, cve_id) > + else: > + mapping = "Patched" > + detail = "backported-patch" # fix-file-included is not > available in scarthgap > + description = None > > if not mapping or not detail: > bb.warn(f"Skipping {cve_id} — missing or unknown CVE status") -- Kamel Bouhara, Bootlin Embedded Linux and kernel engineering https://bootlin.com
-=-=-=-=-=-=-=-=-=-=-=- Links: You receive all messages sent to this group. View/Reply Online (#226542): https://lists.openembedded.org/g/openembedded-core/message/226542 Mute This Topic: https://lists.openembedded.org/mt/116354841/21656 Group Owner: [email protected] Unsubscribe: https://lists.openembedded.org/g/openembedded-core/unsub [[email protected]] -=-=-=-=-=-=-=-=-=-=-=-
